[ PROOFECONOMY ]™GlossaryOriginSpecsDifferential Attribution
Differential attribution is the rule that a stopped attack can be credited to a single control only by matched runs in an otherwise identical environment, with that control active and with it disabled, using fresh canaries of the same technique. A device log naming the rule that fired is not enough.
What it means
A product’s log says “rule 4471 blocked this”. That is the product grading itself. To prove rule 4471 did the work, run it both ways: the attack must land with the rule off and fail with it on.
The rules
- A DUT log or alert naming the control that acted is verification evidence. It may be recorded as an annotation. It never attributes an outcome by itself.
- An outcome that cannot be attributed to one control is attributed to the device; one that cannot be attributed to one device is attributed to the solution. Attribution never moves to a finer level without the evidence.
- Rates are never reported finer than the proof supports.
Lineage
The practice of testing with and without the device comes from the competitive test methodology in Craig Thomas Ellrod, Technical Marketing (2008), Chapter 4. PP-SPEC-077 makes it the rule for crediting a single control. See SUT, DUT, CUT and AUT.